Studies
4 studies · CSV
- Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital Tolsdorf et al. (2025). Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25) Susceptibility and intervention effectiveness varied sharply by staff group, and risk from a few phishing emails lingered about three days. Technical measures (filtering, in-email warnings) worked best, generic [EXTERNAL] tags did little, and some staff reacted to the simulation with fear, shame, guilt, and hostility.
- Cognitive Triaging of Phishing Attacks Heijden & Allodi (2019). 28th USENIX Security Symposium (USENIX Security 19), pp. 1309-1326 Measuring Cialdini-style persuasion triggers in real reported phishing let the authors predict which attacks would draw the most clicks, enabling response teams to prioritize takedowns. Consistency and scarcity triggers were associated with more clicks, reciprocity appeared counterproductive, and authority, social proof and liking showed no clear trend.
- Cyber security fear appeals: unexpectedly complicated Renaud & Dupuis (2019). Proceedings of the New Security Paradigms Workshop (NSPW '19) A review of the wider fear-appeal literature finds real disagreement over whether fear appeals are helpful or advisable, and wide variation in how cyber security fear-appeal experiments are designed. The authors propose a standard protocol for such studies.
- Fear Appeals and Information Security Behaviors: An Empirical Study Johnston & Warkentin (2010). MIS Quarterly, 34(3), 549-566 Fear appeals did increase people's intentions to adopt recommended security actions, but the effect varied across people and depended partly on self-efficacy, response efficacy, perceived threat severity and social influence.